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THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
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DETAILED ACTION 

1. Claims 1-24 have been examined and are pending. 

Claim Rejections - 35 USC §102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under 
section 122(b), by another filed in the United States before the invention by the 
applicant for patent or (2) a patent granted on an application for patent by another 
filed in the United States before the invention by the applicant for patent, except that 
an international application filed under the treaty defined in section 351(a) shall 
have the effects for purposes of this subsection of an application filed in the United 
States only if the international application designated the United States and was 
published under Article 21(2) of such treaty in the English language. 

2. Claim 1-24 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Pham (US 6,446,173). 

As per claim 1: 

method of providing security a network, said method comprising: 

a) detecting a first packet being broadcast in said network, said 
first packet having associated with it an address that identifies an 
untrusted device in said network; and [col.l, lines 58-62] 

b) in response to said detection, broadcasting a signal to cause said 
first packet to be corrupted [col. 12, lines 12-13 and 42-43], wherein said 
first packet is ignored by devices in said network, [col. 10, lines 36-37 and 
col. 13, lines 9-10] 
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As per claim 2: See col. 13, lines 9-10; discussing c) re-broadcasting said 
signal in response to said first packet being detected again. 
As per claim 3: See col. 13, lines 7-14 and col. 12, lines 1-5; discussing c) 
determining that a collision was not caused by broadcasting said signal; and 
d) re-broadcasting said signal according to a predetermined protocol in 
anticipation of further packets being broadcast from said untrusted device. 
As per claim 4: See col. 2, lines 51-52; discussing d) comprises: dl) 
continually broadcasting said signal, wherein a collision will be caused with 
any packet broadcast. 

As per claim 5: See col.1, lines 43-46; discussing said devices in said 

network are substantially compliant with the IEEE 802.3 specification. 

As per claim 6: See col.2, lines 55 and col. 5, lines 23-30; discussing 

said address is a physical address for said untrusted device. 

As per claim 7: See col.2, lines 55 and col.5, lines 23-30; discussing 

said address is a Medium Access Control (MAC) address. 

As per claim 8: See col.2, lines 55 and col.5, lines 23-30; discussing 

said address is a source Medium Access Control (MAC) address of said first 

packet. 

As per claim 9: See col.2, lines 55 and col.5, lines 23-30; discussing 
said address is a destination Medium Access Control (MAC) address of said 
first packet. 

As per claim 10: See col., lines ; discussing said network is an Ethernet. 
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As per claim 11: 

a device for providing security in a network, said device comprising: 
memory to store a list of addresses; [col. 13, lines 60-65] 
detection logic for detecting a first packet that is considered a 

security risk, said detection based on comparing said list of addresses 

with an address in said first packet; [col. 5, lines 23-30] 

logic to transmit a second packet while said first packet is being 

broadcast [col. 10, lines 33-34], wherein said device is operable to cause 

a collision between said first packet and said second packet, [col. 12, 

lines 12-13 and 42-43] 

As per claim 12: See col.5, lines 23-30; discussing said list of 
addresses comprises trusted addresses. N 

As per claim 13: See col. 12, lines 40-48; discussing said list of 
addresses comprises untrusted addresses. 

As per claim 14: See col.5, lines 23-30; discussing said detection logic 
is further for comparing a physical address in said first packet with said 
list of addresses. 

As per claim 15: See col. 2, lines 55 and col.5, lines 23-30; discussing 
said physical address is a medium control access (MAC) destination 
address. 

As per claim 16: See col. 2, lines 55 and col.5, lines 23-30; discussing 
said physical address is a medium control access (MAC) source address. 
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As per claim 17: See col.9, lines 52-56; discussing said device further 
comprises logic operable to transmit a warning message if a packet 
having an untrusted address is detected. 

As per claim 18: See col. 5, line 33; discussing said device is selected 
from the group comprising: a router, a switch, and a network interface 
card (NIC). 
As per claim 19: 

method for providing security in a segment of a network, said method 
comprising: 

a) determining that a first packet broadcast in said segment is 
associated with an untrusted node; and [col.9, lines 52-56 and col. 13, 
lines 9-10] 

b) broadcasting a second packet to cause a collision between said 
first packet and said second packet [col. 10, lines 33-34 and col. 12, 
lines 12-13 and 42-43], wherein nodes in said network ignore said first 
packet, [col. 10, lines 36-37 and col. 13, lines 9-10] 

As per claim 20: See col.5, lines 23-30 and col. 12, lines 40-48; 
discussing al) reading an address in said first packet, said first packet 
received at a first node; and a2) determining that said address is on a list 
stored on said first node, said list comprising unauthorized addresses, 
wherein said first packet is determined to be associated with said 
untrusted node if said address is on said list. 
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As per claim 21: See col.5, lines 23-30 and col. 12, lines 40-48; 

discussing: c) adding to said list of unauthorized addresses an 
unauthorized address. 

As per claim 22: See col.5, lines 23-30 and col. 13, lines 60-65; 

discussing al) reading an address in said first packet, said first packet 
received at a first node, said list comprising authorized addresses; and 
a2) determining that said address is on a list stored on said first node, 
wherein said first packet is determined to be associated with said 
untrusted node if said address is not on said list. 

As per claim 23: See col.5, lines 23-30; discussing c) adding to a list of 
authorized addresses an authorized address. 

As per claim 24: See c col. 10, lines 36-37 and col. 13, lines 9-10; 

discussing c) determining that a third packet broadcast in said segment 
is associated with said untrusted node; and d) broadcasting a fourth 
packet to cause a collision between a said third packet and said fourth 
packet, wherein nodes in said segment ignore said third packet. 



— • - Application/ Control Number: 10/061,376 Page 7 

Art Unit: 2135 

Conclusion 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to LEYNNA T. HA 
whose telephone number is (571) 272-3851. The examiner can normally 
be reached on Monday - Thursday (7:00 - 5:00PM). 

If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Kim Vu can be reached on (571) 272-3859. 
The fax phone number for the organization where this application or 
proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained 
from the Patent Application Information Retrieval (PAIR) system. Status 
information for published applications may be obtained from either 
Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov. 
Should you have questions on access to the Private PAIR system, contact 
the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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